Enable seccomp for virtio-fs

Add x86_64 and arm seccomp policy files for the virtio-fs device.

BUG=b:136128319
TEST=Run a vm with a sandboxed virtio-fs device

Change-Id: I8ea7c5d3e90696077f0c2b1f942cb286a0b36cf4
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1916559
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>

1 files changed, 8 insertions, 9 deletions

diff --git a/src/linux.rs b/src/linux.rs
index fc4c63e..bd6ee5c 100644
--- a/src/linux.rs
+++ b/src/linux.rs
@@ -761,17 +761,16 @@ fn create_fs_device(
 
         j.no_new_privs();
 
-        // TODO(chirantan): Enable seccomp
         // Use TSYNC only for the side effect of it using SECCOMP_RET_TRAP, which will correctly kill
         // the entire device process if a worker thread commits a seccomp violation.
-        // let seccomp_policy = cfg.seccomp_policy_dir.join("9p_device.policy");
-        // j.set_seccomp_filter_tsync();
-        // if cfg.seccomp_log_failures {
-        //     j.log_seccomp_filter_failures();
-        // }
-        // j.parse_seccomp_filters(&seccomp_policy)
-        //     .map_err(Error::DeviceJail)?;
-        // j.use_seccomp_filter();
+        let seccomp_policy = cfg.seccomp_policy_dir.join("fs_device.policy");
+        j.set_seccomp_filter_tsync();
+        if cfg.seccomp_log_failures {
+            j.log_seccomp_filter_failures();
+        }
+        j.parse_seccomp_filters(&seccomp_policy)
+            .map_err(Error::DeviceJail)?;
+        j.use_seccomp_filter();
 
         // Don't do init setup.
         j.run_as_init();